vuln-triage

Vulnerability Triage

Translate verified vulnerability identities into an operator decision: what is affected, what exposure is established or unknown, how urgent the response is, what remediation is justified, and whether an advisory should be prepared. This is the judgment layer of the security chain, not another scanner.

Use cve-audit first to prove the exact dependency versions and OSV advisory identities. vuln-triage then reasons about operational exposure and priority without changing those facts. An advisory draft can later move to vuln-disclosure, which owns the publication boundary.

Runners

scan accepts the exact CVE audit result, its independent verification packet, and the sealed receipt reference. Every assessment remains bound to dependency, installed version, and advisory id. Judgment may classify priority, distinguish established from unknown exposure, and propose remediation, but confidence must describe only that judgment—the CVE identity is already verified.

advisory accepts only a validated triage packet. It prepares precise wording for the admitted advisory ids and returns a review packet with publication_status: not_published. It does not call a repository, advisory, email, or social provider.

Operating standard

• Keep verified identity, exposure judgment, and remediation confidence separate.
• State affected versions, preconditions, impact, and mitigations precisely.
• Treat unknown exposure as a reason to investigate or escalate, not as proof of exploitation or safety.
• Avoid alarmism and vague severity labels. Explain the operational reason for priority and the evidence still missing.
• Preserve every verified finding. Adding a new CVE or silently omitting one invalidates the packet.

The finalized triage packet adds deterministic escalation criteria for high priority, unknown exposure, and low-confidence judgments. A clean audit returns no_verified_findings; it does not certify the target secure.

Inputs and result